Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 bb6a677ded7d2c12…

MALICIOUS

Office (OOXML)

42.2 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: ce3fc7f74a314566ace76467d87d7d59 SHA-1: 95867b7f3f1c78c89db8f20ea7ba02a9a715e458 SHA-256: bb6a677ded7d2c120740e1b74f952a6a82af8bb4c10ae3a0ca689a32e09f1088
320 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The OOXML document contains a Workbook_Open macro that executes obfuscated VBA code. This code references cmd.exe and PowerShell, and uses WMI's Win32_Process.Create method to launch them. This strongly suggests the macro's purpose is to download and execute a second-stage payload. The VBA code itself is heavily obfuscated, making a precise analysis of its actions difficult, but the intent to execute external commands is clear.

Heuristics 7

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
48b85e8538d40a222582b5bce7f61798bd1a3475ddf3d6e0fc556b9e6c77650b		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 36441 bytes
vbaProject_00.bin
605a158934e1860c71c8526517e5c06ba2c3152d0af8b223714f8ae0cfee67d8		 vba-project OOXML VBA project: xl/vbaProject.bin 11776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.